Your API requests belong in files you own, next to your code.
Seeing what that code actually sends should not need an account or a server.

How it actually works

Not marketing language — this is the literal request and capture path, because a "local only" promise is only as good as its mechanism.

1. A request is a .http file, and nothing else

   Collections are folders under .callflow/ in your workspace. Each file holds one or more requests separated by ###, in the same format REST Client has read since 2016: method and URL, headers, a blank line, the body. There is no database, no proprietary bundle, and nothing that stops working if you uninstall the extension. The files diff in git like any other source.

2. Environments keep secrets out of the file

   environments.json holds your variables per environment. Any variable you list under secrets is stored in VS Code's SecretStorage instead — the file on disk keeps an empty string, so a token never ends up in a commit. CallFlow: Set Secret… stores one in a step, the Auth tab offers "Store as secret" when you type a password or token, and saving a request with a plain-text credential in a header or URL asks first. Variables resolve file-first, then environment, then dynamic values like {{$uuid}}, then chained values from an earlier response.

3. OAuth 2.0 without pasting tokens around

   Define a profile once in environments.json (authorization code with PKCE, or client credentials), pick it in the Auth tab, and the request sends Bearer {{$oauth profile}}. Sign-in opens your browser and comes back to a listener on 127.0.0.1. Tokens live in SecretStorage, never in a file or in history, and refresh on their own. Free.

4. Sending uses Node's own HTTP stack, so timings are real

   Requests go out over node:http and node:https directly, not fetch, which is what makes DNS, connect, TLS and first-byte timings precise and cancellation immediate. Redirects are followed up to ten times and the Authorization header is never forwarded to a different origin.

5. Capture (Pro) is a proxy on 127.0.0.1, scoped to your workspace

   Start capture and CallFlow opens a proxy on a random port bound to 127.0.0.1 only. It then sets HTTP_PROXY, HTTPS_PROXY and the CA-bundle variables that Node, Python, curl, Git, the AWS SDK, Deno, Cargo and Java honour — in this workspace's terminals and debug sessions, through VS Code's own environment mechanism. No system proxy setting is touched, nothing outside VS Code is routed, and stopping capture clears it all.

6. The certificate authority is generated on your machine

   To read HTTPS, CallFlow generates a local CA on first use and keeps the private key in VS Code's storage with owner-only permissions. For terminal targets you do not need to trust it system-wide, because the environment variables point each tool at the CA file directly. System trust only matters for GUI apps, and the exact command is shown before it runs, never behind a silent prompt.

What we can honestly say instead of "trusted by thousands"

CallFlow launched in September 2026. It has been downloaded about 3,400 times from Open VSX, the registry Cursor and VSCodium install from, though download counts include updates, and it has no reviews yet. So rather than ask you to trust a number, here is what we can state precisely, because it's true of the code today:

• Apart from the requests you send on purpose and the traffic your own processes send through the capture proxy while it is on, CallFlow makes one request of its own: from version 0.2.4, an anonymous ping once a day with four fields — the product name, the CallFlow version, your editor's name (VS Code, Cursor, Windsurf, VSCodium…) and a random install id CallFlow made up. It tells us how many installs are actually used, which download counts can't. It is off whenever your editor's telemetry is off, and callflow.telemetry.enabled turns it off on its own.
• Your requests live in .callflow/ inside your workspace, as files you can open in any editor. History and captures live in VS Code's global storage on your machine. Neither is synced or uploaded. The only CallFlow server is the one that counts those daily pings; it keeps one record per install per day (version and editor name) for 60 days, and never stores IP addresses.
• The capture proxy binds to 127.0.0.1 on a random port and is unreachable from any other machine. The CA it uses is generated locally; its private key is written with owner-only permissions and never leaves your storage folder.
• There is no analytics SDK, no crash reporter, and no tracking pixel — in the extension or on this page. The daily ping above is the whole of CallFlow's telemetry.
• We — the people who make CallFlow — cannot see your requests or captures. Not "we don't look." There is nowhere for them to arrive.
• The one thing that does leave your machine is a Pro purchase, handled entirely by Paddle as the seller of record. See CallFlow's privacy policy for exactly what the ping and a purchase involve.

FAQ

Why build another REST client?

Because the two people relied on stopped being reliable. Thunder Client barred companies from its free version in October 2023, cut free to three collections and no environments in February 2025, removed collections from free entirely in August 2025, and now charges per user per month; its Marketplace rating is 2.39 stars. REST Client, the free fallback, has had no release since August 2022 with dozens of pull requests waiting. Postman's extension requires an account. CallFlow exists so that a request editor inside your editor does not come with any of those conditions attached.

Does CallFlow send my requests anywhere?

Only to the URL you typed. CallFlow has no sync, no update check of its own and no licence check; the one request it makes itself is the anonymous daily install ping, which contains nothing about your requests and can be turned off. Everything it stores is on your machine, and the exit is a folder of text files.

Am I locked into CallFlow's format?

No. Requests are stored in the .http format that REST Client and several other tools already read, with ### separators and {{variable}} substitution. If CallFlow vanished tomorrow, your collections would still open, still diff, and still run elsewhere.

How does capture route traffic without changing my system proxy?

VS Code lets an extension add environment variables to the workspace's terminals and to debug launch configurations. CallFlow uses that to set the standard proxy and CA-bundle variables while capture is on, and removes them when you stop. Processes started outside VS Code are untouched, and localhost can be included or excluded with a setting.

Do I have to install a root certificate?

Not for terminal and debug targets: tools that honour NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and similar are pointed at the local CA file directly. Trusting the CA at the OS level is only needed for GUI applications, is optional, and the command CallFlow would run is shown before you confirm it.

What can capture not see?

Anything that pins certificates, HTTP/3 (QUIC is disabled for the launched browser target, so traffic falls back to HTTP/2 or HTTP/1.1), gRPC, and Java processes that ignore JAVA_TOOL_OPTIONS. Version 0.1 covers HTTP/1.1 and HTTPS from terminals and debug sessions; that scope is stated here rather than discovered after purchase.

How does this compare to Fiddler, Charles or Proxyman?

Those are system-wide proxies and see everything on the machine; CallFlow is narrower on purpose and sees only what your workspace runs. Fiddler Everywhere requires an account and a subscription, and Fiddler Classic's licence became non-commercial on 3 August 2026. Charles is $50 and Proxyman $89, both one-time. If you need to capture a whole machine or a phone, one of those is the better tool; if you want the calls your code made, next to the code, for $20 once, that is what CallFlow is for.

Does buying Pro create an account somewhere?

No account with us. Paddle handles the purchase and delivery of your licence key. The extension verifies that key's signature locally and never checks in with a server afterward — so we don't know when, where, or how often you activate it.

Does it work in Cursor, VSCodium or Windsurf?

Cursor and VSCodium: yes. CallFlow's full integration suite (sending, HTTPS, terminal capture with the local CA, saving captures as requests) passes inside Cursor 3.23 and VSCodium 1.135, tested on 2026-10-05. Both install it from Open VSX: search "CallFlow" in the Extensions view. Windsurf and other Open VSX editors should work the same way but haven't been tested. One Pro licence covers all of them.

Is the Pro price final?

Yes. $20, one-time, sold through Paddle, for an individual. No subscription, no early-bird games, no countdown timers. Companies buying for several people can get a company licence.

Can I try Pro before buying?

Yes. The first time you use capture, scripts and tests, or response diff, a 14-day trial of everything in Pro starts by itself. There's no account, email or card, and it lives only on your machine. When it ends, the free REST client keeps working exactly as before, and CallFlow tells you once.